Loading vulnerability…
Command Injection in kube-logging logging-operator Fluentd configuration rendering
CVE-2026-54680 is a command injection vulnerability in kube-logging logging-operator affecting versions prior to 6.6.0. The flaw is in the Fluentd configuration renderer, FluentRender, in the component responsible for generating Fluentd configuration from logging custom resources. CRD-supplied string values, including Flow record_transformer.records content, are written directly into the generated Fluentd configuration without proper escaping or neutralization. An attacker with permission to create Flow resources can abuse this unsafe rendering behavior to inject additional Fluentd configuration directives, including a catch-all match block configured to invoke exec, resulting in arbitrary command execution within the Fluentd aggregator process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary command execution inside the Fluentd aggregator managed by logging-operator. Because the vulnerable component processes attacker-controlled logging CRD content into executable Fluentd configuration, compromise can extend beyond log manipulation to full execution in the aggregator context. In shared or multi-tenant deployments, this can allow a lower-privileged tenant with Flow creation rights in a watched namespace to compromise the shared logging plane, access data handled by the aggregator, interfere with log integrity and availability, and potentially reach other services accessible from the aggregator environment, including sensitive internal or cloud metadata services.
If you can’t patch tonight, do this now.
Until the fixed version is deployed, strictly limit which users and service accounts can create or modify Flow and related logging custom resources in watched namespaces. Reduce exposure by isolating and hardening the Fluentd aggregator, minimizing its privileges, constraining its network reachability, and avoiding shared aggregator deployments across mutually untrusted tenants where possible.
Patch, then assume compromise.
Upgrade kube-logging logging-operator to version 6.6.0 or later, which fixes the unsafe Fluentd configuration rendering behavior. If consuming the project as a module or commit-based dependency, deploy a build that includes the upstream fix referenced for the 6.6.0 release.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.